CVE-2026-102940

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.4.0, controllers/CDocument.class.php write actions, including moveactionprocess, do not verify the caller's access to the source document, current patient and category, or destinati...

CVE-2026-102940 OpenEMR: Missing Write ACL Allows Unauthorized Document Reassignment

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.4.0, controllers/CDocument.class.php write actions, including moveactionprocess, do not verify the caller's access to the source document, current patient and category, or destinati...

CVE-2026-102940

In OpenEMR versions prior to 8.4.0 , a vulnerability exists in controllers/C_Document.class.php write actions, specifically within move_action_process() . The system fails to verify if the caller has authorized access to the source document, current patient, or destination patient/category before...

CVE-2026-102940 OpenEMR: Missing Write ACL Allows Unauthorized Document Reassignment

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.4.0, controllers/CDocument.class.php write actions, including moveactionprocess, do not verify the caller's access to the source document, current patient and category, or destinati...

EUVD-2026-117779

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.4.0, controllers/CDocument.class.php write actions, including moveactionprocess, do not verify the caller's access to the source document, current patient and category, or destinati...